An Introduction to Penetration Testing

A Pen Test or penetration testing is one of the most effective ways for enterprises to proactively identify cybersecurity gaps and fix them before they are exploited by malicious actors. But what exactly is penetration testing and what does it involve? Here's a look.

What is Penetration Testing 

A pen test or penetration test is an authorised attempt to hack and gain access to an organization's data assets. Its purpose is to identify vulnerabilities so that they are identified, and rectified before any potential cyber attack. 

This is similar to stress tests conducted by doctors with patients. A stress test can estimate your risk of having heart disease. A doctor or trained technician performs the test with the objective of learning how much your heart can manage before an abnormal rhythm starts or blood flow to your heart muscle drops.

Similarly an ethical hacker, via a penetration test, is testing for any weaknesses in your organization’s cyber security, he or she is attempting to break into your organization's network to test for vulnerabilities.  If the ethical hacker succeeds, your organization gains valuable information on how best to  solve these weaknesses before the event of an actual cyber attack by a malicious actor. 

Why you need penetration testing

Penetration testing, also called pen testing, looks deeply into your business to see how vulnerable it is to malicious hackers. It goes far beyond ordinary security assessments or compliance audits. Here are some of the ways that pen testing stands apart:

1. It doesn’t merely expose weaknesses; it simulates real-world attacks to show how your sensitive data, business systems, financial assets and employees would fare in the event of the real thing.
   
   
2. It tests your system’s ability to detect breaches, whether internal or external, when they occur.
   
   
3. Although some functions may be automated, pen testing relies heavily on skilled, experienced professionals who are able to analyse systems in the same way that malicious hackers would. Many, in fact, are certified ethical hackers. It takes one to know one.
   
   
4. Cyber criminals rarely target individual security tools. Instead, they look for gaps between tools that don’t work especially well together. An in-depth pen test uncovers these gaps.
   
   
5. It is completely unbiased. Sometimes, a fresh set of eyes reveals vulnerabilities that were overlooked.
   
   
6. It ensures that your company is in full compliance with the new data breach notification law.

How penetration testing works

Pen testers, using both software applications and manual methods, start by doing a little reconnaissance. They gather information about your business, from the perspective of it being the potential target of a hacker. They then identify vulnerable entry points. Finally, they attempt to break into your system, and they report back to you how successful they were. Remember that pen testers are the good guys. These type of attacks, sometimes called “white-hat” attacks, are highly educational.

After a thorough discussion of your needs and concerns, the testers will decide on the best approach, which could include any or a combination of the following:

1. In targeted testing, your information technology team and the pen testers work together to conduct experiments and analyse the results.
   
   
2. In external testing, attempts are made to hack into visible entities such as web servers, email servers and domain name servers. The goal is to find out if these entities are prone to external attacks. External tests also reveal how deeply a hacker could penetrate your system after gaining access to it.
   
   
3. The objective of internal testing is to find gaps behind your firewall. Testers are given the same authorisation and levels of access that employees have. If there are weaknesses that would allow unauthorised access to data, this test will expose them. Compromised or disgruntled individuals within a company are just as dangerous as external hackers.
   
   
4. Some businesses request blind testing. This strategy forces pen testers to proceed with very little information about the company they are testing. For example, they might be provided with only the company’s name. The more information that they can unearth about the company, the greater its security risks.
   
   
5. Double-blind testing is even more exhaustive. With the exception of one or two individuals, no one is told that a test is being conducted. This type of test has the most unbiased results, so it’s highly useful for evaluating security awareness and response protocols.

Types of Penetration Testing

White Box Penetration Testing - During a white-box penetration test the tester is provided with full network and system information, this is usually done to save on cost and time taken with the overall test. 

Black Box Penetration Testing - On the other hand, during black-box penetration tests the tester is provided with no network and system information similar to an unprivileged user. This is done to simulate an authentic attack where the malicious attacker has no information on the network or system. 

Grey Box Penetration Testing - In a grey-box penetration test, only limited information is shared with the tester. Usually this takes the form of login credentials. Grey box testing is useful to help understand the level of access a privileged user could gain and the potential damage they could cause.

What are the stages of a Penetration Test? 

A typical penetration test is carried out in the following four stages: 

Reconnaissance - In this stage, the ethical hacker collects information  and data via public and private sources on the target to inform their attack strategy for example, discovering possible vulnerabilities that can be exploited during the actual hack. The complexity of this stage may differ from company to company as well as the scope and objective of the penetration test. 

Scanning - This is where the ethical hacker utilises tools like open services, application security issues and open source vulnerabilities etc, to scan the company's website or system for weaknesses. 

Gaining access - Malicious hackers may access your companies networks to steal, change or delete data for financial gain or to simply damage the reputation of your company. During this stage the hacker conducting the Penetration Test will test each of these cases  and must decide on the best tools and techniques to gain access to your organization’s system, whether through a weakness, such as SQL injection, or through malware, social engineering, or something else.

Maintaining access - Once penetration testers gain access to your company’s network, their simulated attack must stay connected long enough to accomplish their goals: exfiltrating data, modifying it, or abusing functionality. The goal of a penetration test is to simulate the actual impact of a cyber attack if it is to happen. 

Putting test results to good use

You may find that your security policies and procedures are in dire need of streamlining or a complete overhaul. Have you identified the role that each staff member would play in the event of an emergency? Have you established channels of communication and a chain of command? Do your employees have the appropriate level of security awareness? Pen testing highlights areas in which improvement is needed.

Analysing pen test results will help your IT staff address your risks in order of importance. Results will also indicate how quickly and efficiently your IT team could respond to an attack.

You can also find out just how cost-effective your security tools are. State-of-the-art security tools are outrageously expensive. Pen testing will help you determine each security tool’s value. If you’re not getting a bang for your buck, you’ll find out in short order. Testers can also advise you about good tools that just need a little bolstering.

How often pen tests should be conducted

This depends on how attractive your business is to malicious hackers, but ongoing testing is the most effective. Frequent updates and patches may address existing vulnerabilities, but they also introduce new ones. Every time you deploy a new app, modify your infrastructure or introduce a new cloud service, you’re inviting security issues that even your brightest IT employee might overlook.

A single hacker could put you out of commission for an hour or put you out of business for good. With so much at stake, it makes good business sense to invest in ongoing penetration testing.

Looking to identify the vulnerabilities in your cybersecurity setup? StickmanCyber's penetration testing services brings in CREST ANZ registered testers to comb through your systems, identify possible gaps, and prepare a comprehensive list of action items to mitigate risks. 

Ready to proactively take charge of your cybersecurity. Book a penetration test today!